nixos-config/services/vikunja.nix

{ config, my, secrets, ... }:

let fqdn = "todo.${my.domain}";
in {
  sops.secrets."vikunja/env" = {
    sopsFile = ../secrets/sops/vikunja.yaml;
    restartUnits = [ "vikunja.service" ];
  };

  services.vikunja = {
    enable = true;
    frontendScheme = "https";
    frontendHostname = fqdn;
    environmentFiles = [ secrets."vikunja/env".path ];
    database.type = "sqlite";
    settings = {
      service = {
        timezone = "Europe/Vienna";
        publicurl = fqdn;
        enableregistration = false;
      };
      log.http = "off";
      files.maxsize = "64MB";
      defaultsettings.week_start = 1;
    };
  };

  services.nginx.virtualHosts.${fqdn} = let serverCfg = config.services.vikunja;
  in {
    forceSSL = true;
    useACMEHost = my.domain;
    kTLS = true;
    locations."/" = {
      proxyPass = "http://[::1]:${toString serverCfg.port}";
      proxyWebsockets = true;
      extraConfig = ''
        client_max_body_size 64M;
      '';
    };
  };
}